You restored a new phone, opened the authenticator app, and the ChatGPT entry is not there. Or the old phone is in a drawer with a dead battery and a forgotten PIN. The login screen accepts the password, prompts for a six-digit code, and there is no way through. The backup codes you were told to save at MFA enrollment are nowhere: not in 1Password, not in a Google Doc, not on a sticky note.
Fastest fix first: on the verification screen, click Try another method. As of June 2026 OpenAI lists every factor enrolled on the account there (passkey, push notification, authenticator app, text message, email). If any one of them still reaches you, you are in within a minute. If none does, you fall back to a support ticket with identity proof: those cases usually resolve in 24-72 hours, because OpenAI will not disable MFA without verifying you own the account.
One critical exception, new in 2026: if you turned on Advanced Account Security (launched April 30 2026), OpenAI Support cannot recover the account for you at all. Only your own recovery key or a backup passkey/security key works. Jump to the Advanced Account Security section if that is you.
Which bucket are you in?
Match your screen to a row before you do anything else. The right fix is very different depending on what the login prompt offers.
| What you see on the verify screen | Likely cause | Go to |
|---|---|---|
| Six-digit code field, authenticator empty on new phone | Authenticator never synced to cloud | Cause 1, Step 2-3 |
| ”Invalid code” on a list you saved | Codes reformatted (smart quotes/dashes) | Cause 3, Step 1 |
| No SMS option, or SMS to a number you lost | SMS removed or number recycled | Cause 4, Step 3 |
| ”Insert your security key”, no code option | Hardware key only, key missing | Cause 5, Step 3-4 |
| Password is rejected entirely (no code prompt) | Wrong account, or Advanced Account Security | Cause 6 / AAS section |
| ”Try another method” lists email or push | At least one live factor remains | Step 3 (fastest) |
Common causes
Ordered by how often each actually applies.
1. Authenticator app was never backed up to the cloud
Google Authenticator, Microsoft Authenticator, and older Authy installs do not auto-sync TOTP secrets across devices by default. A factory reset, lost phone, or “restore from backup” that skips app data wipes the seeds permanently.
How to spot it: The new phone shows the authenticator app reinstalled but with zero entries, or only entries you re-added manually.
2. Backup codes were generated but never saved
ChatGPT shows the 10 single-use codes once at MFA setup. Many users dismiss the modal assuming they can re-display them later. They cannot — the codes are only shown at enrollment and after an explicit regenerate.
How to spot it: Search your password manager and email for chatgpt, openai, and 8-character alphanumeric strings. No hits means they were never stored.
3. Backup codes were saved but reformatted
Codes are often pasted into a note with smart quotes, line wraps, or trailing spaces. The login form rejects them as invalid even though the characters look right.
How to spot it: You have a list that looks like backup codes, but every attempt returns “invalid code”. Inspect for non-ASCII punctuation or stripped dashes.
4. SMS or WhatsApp fallback was disabled or the number was ported
Some accounts had SMS (or, since 2026, a WhatsApp code) as a secondary factor but it was later removed for security, or the original phone number was ported / recycled to a new carrier. The “Text message” option is gone or sends to a number you no longer own.
How to spot it: The verify screen does not list Text message under Try another method, or it sends to a partially masked number you do not recognize.
5. Account uses a security key (WebAuthn) and the key is missing
Pro / Enterprise users sometimes enrolled a hardware key (YubiKey, Titan) as the only second factor. If the key is lost or broken and no backup key was registered, software MFA recovery flows do not apply.
How to spot it: The login prompt says “insert your security key” and offers no TOTP / SMS alternative.
6. Wrong account — the MFA is on a different email
If you have two ChatGPT accounts (personal + work, or Google SSO + email-password) it is easy to type the wrong email and assume MFA is broken. The other account does not have MFA at all.
How to spot it: Try the login with each email variant. If one accepts password-only, the MFA was on the other account, not the one you are trying.
Before you start
- Stop hammering the login form. After 5-10 failed MFA attempts ChatGPT may rate-limit or temporarily lock the account, adding 1-24 hours to recovery.
- Find any device that may still hold a live session — old laptop, work desktop, mobile app you have not signed out of. An active session is recovery gold.
- Locate the original signup email and any payment receipts; OpenAI support will ask.
- If this is a Team / Enterprise account, contact your workspace admin first — they can disable MFA for you in seconds without a support ticket.
Information to collect
- The exact email address on the account (including capitalization and dots for Gmail).
- Approximate date of account creation and approximate date of last successful login.
- Last 4 digits of the payment card on file, if you have a paid plan.
- A government ID matching the billing name (required by support for identity proof).
- Screenshots of any active session you find on another device —
/api/auth/sessionJSON or the account email visible in the UI. - The model of phone the authenticator was on, and whether it was factory-reset or replaced.
Step-by-step fix
Cheapest paths first; escalate only when each fails.
Step 1: Try every saved location for backup codes
Search exhaustively before opening a support ticket. In your password manager:
chatgpt
openai
2fa
mfa
backup
recoveryIn your email, search for noreply@tm.openai.com, noreply@auth.openai.com, and any message with subject containing “two-factor” or “verification”. The original MFA enrollment confirmation sometimes includes the codes inline.
Step 2: Find a still-authenticated device
Open ChatGPT on every browser profile, phone, tablet, and old laptop you own. If any session is still active:
1. Open https://chatgpt.com → confirm logged in
2. Navigate to Settings → Security → Multi-factor authentication
3. Click "Disable" or "Regenerate backup codes"
4. Save the new codes immediately
5. Log out of the device only AFTER the new codes are savedThis is the fastest path; it bypasses support entirely.
Step 3: Use “Try another method” on the verify screen
When ChatGPT asks for your code, look for Try another method (this is the current label as of June 2026; older builds said Trouble signing in?). It lists every factor enrolled on the account, and OpenAI defaults to the most secure one first, so the option that still works may be one click away:
- Passkey (if you registered one)
- Push notification to a trusted device you still have
- Authenticator app (only helps if the app survived)
- Text message to a previously verified phone
- Email code to the account address
If any of these reach you, sign in, then go straight to Step 6 to re-enroll MFA and save the backup codes this time. This path beats a support ticket by days.
Step 4: Open a support ticket with full identity proof
Go to https://help.openai.com, open the chat widget (bottom right), and tell it I lost access to my 2FA method. That routes you to the account-recovery intake instead of generic help. If you can still receive email at the account address, reply to the support thread there. If you have also lost the email inbox, file the appeal form at https://openai.com/form/appeal/ and include your User ID and Org ID (find these in any old billing email or an active session’s Settings → Organization).
Include in your first message:
Subject: Locked out of MFA — account [your email]
Body:
- Account email: <your-email>
- Plan: Plus / Team / Enterprise / Free
- Approximate signup date: <month/year>
- Last 4 of payment card on file: <####>
- Last successful login (approx date): <date>
- Device that held authenticator: <make/model>
- Reason MFA is inaccessible: <factory reset / phone lost / etc>
Attached: photo of government ID matching billing name.
I cannot recover backup codes. Please disable MFA so I can re-enroll.One detailed message beats five vague follow-ups. Tickets with ID + payment proof typically resolve in 24-48 hours.
Step 5: Use a session-cookie export if you find one
If you find a logged-in browser but it will not let you reach Settings (some flows re-challenge MFA for sensitive pages), export the cookies and inject them into a fresh profile:
# In DevTools on the logged-in browser:
# Application → Cookies → chatgpt.com → copy __Secure-next-auth.session-tokenThen in a new browser, set the same cookie before navigating. Note: this is a personal-recovery technique on your own account only; not for shared / Team accounts.
Step 6: Re-enroll MFA correctly after recovery
Once you are back in, immediately:
- Go to
Settings → Security → Multi-factor authentication. - Click
Regenerate backup codes. - Save the 10 codes in your password manager as a secure note titled
ChatGPT MFA backup codes. - Re-add the TOTP entry to an authenticator that syncs across devices (Authy with cloud backup, 1Password TOTP, Bitwarden).
- Enroll a second factor type if possible (TOTP + security key, or TOTP + SMS).
Advanced Account Security: the no-support path
In late April 2026 OpenAI launched Advanced Account Security, an opt-in mode that removes password sign-in entirely and replaces it with passkeys or FIDO security keys (OpenAI ships a Yubico bundle: YubiKey C Nano + C NFC). Trusted Access for Cyber members were required to enable it from June 1 2026.
If your account is on this mode, the rules above do not apply. OpenAI deliberately removed email and SMS recovery, and OpenAI Support cannot recover the account for you. Recovery is limited to credentials you hold yourself:
- A backup passkey synced to another device (iCloud Keychain, 1Password, Google Password Manager).
- A second hardware security key you registered (the whole point of the two-key Yubico bundle).
- The one-time recovery key generated at enrollment — a long string OpenAI shows once and tells you to store offline.
To recover: go to the sign-in screen, choose Try another method, and select your backup key or Use recovery key. Enter the recovery key string exactly (it is case-sensitive; do not paste from an app that altered the characters). If you have none of these three, the account is unrecoverable by design and a fresh signup is the only route. This is why enrollment forces you to register at least two methods, one of them cross-device, before it turns on.
Verify
- Log out completely, log back in, and confirm the MFA prompt accepts the new TOTP code.
- Try one of the freshly saved backup codes (it will be consumed — generate a replacement immediately).
- On a second device, log in and confirm the new authenticator entry produces a matching code.
- Check
Settings → Security → Active sessionsand revoke any session you do not recognize.
Long-term prevention
- Always save the 10 backup codes the moment they appear at MFA enrollment. Treat the modal like a one-shot screen because it is.
- Use an authenticator that syncs to the cloud — Authy, 1Password, Bitwarden, iCloud Keychain. Google Authenticator now syncs too but requires explicit opt-in.
- Register at least two TOTP devices (phone + tablet) so loss of one is not catastrophic.
- For Plus / Team accounts, register a recovery email different from the primary login email.
- Enroll a second factor type, not just a second device of the same type. As of June 2026 OpenAI supports authenticator app, push notification, text message, WhatsApp code, and passkey. A passkey plus an authenticator means one wiped phone never locks you out.
- Keep a paper printout of backup codes in a home safe for catastrophic device loss.
- If you use a hardware security key, always register a second key as backup and store it separately.
- If you turn on Advanced Account Security, treat the one-time recovery key like a seed phrase: write it down and store it offline. Once that mode is on, no support ticket can save you.
Common pitfalls
- Reusing the same backup code twice — each is single-use and burning one in panic does not help if you cannot complete login.
- Submitting a support ticket without identity proof and then waiting — support will reply asking for ID, adding 12-24 hours.
- Creating a new ChatGPT account because the old one feels lost — the new account does not inherit your subscription, history, projects, or custom GPTs.
- Trying to reset the password instead of MFA — password reset does not bypass MFA, and locking your password too makes recovery harder.
- Pasting backup codes from a Word doc that auto-corrected dashes; type them by hand or paste from plain text.
- Asking your bank to issue a chargeback to “force support attention” — this gets the account terminated, not unlocked.
FAQ
Q: Will OpenAI support ever ask for my password to verify identity?
No. Support will never request your password. Anyone asking for it is a phishing attempt; report and delete.
Q: How long does MFA reset typically take after a ticket with ID?
24-72 hours for individual accounts. Team / Enterprise tickets routed through the workspace admin are usually under 1 hour because the admin acts directly.
Q: Can I just delete the account and resubscribe to get past MFA?
You can request deletion, but the email enters a cooldown (often 14-30 days) before you can register the same email again. You also lose all history. Recover the account instead.
Q: My authenticator says the code is “expired” before I can type it. What is wrong?
Phone clock drift. TOTP needs the device clock within 30 seconds of server time. Enable automatic time sync on the phone — see ChatGPT 2FA locked out for the full fix.
Q: I turned on Advanced Account Security and lost my key. Can support still help?
No. That is the deliberate trade-off of Advanced Account Security (launched April 2026): OpenAI removed email and SMS recovery, so support cannot disable it for you. You can only get back in with a backup passkey, a second registered security key, or the one-time recovery key from enrollment. If you have none, the account cannot be recovered and you must start a new one.
Q: I have no backup codes, no working factor, and no ID. Is there any path?
Without identity proof OpenAI will not disable MFA, because that would be a takeover vector. The realistic options are: find a still-logged-in device (Step 2), recover any one enrolled factor via Try another method (Step 3), or obtain a government ID matching the billing name and file the recovery request (Step 4). A new account is the last resort and does not carry over your subscription or history.
Q: Does this also apply to ChatGPT Enterprise SSO accounts?
Partially. If your org uses SSO, MFA may be controlled by your identity provider (Okta, Azure AD). Recovery goes through your IT admin, not OpenAI. See ChatGPT Enterprise SSO fail.